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Abstract 

This paper presents the. theoretical foundation and 
application of two univariate failure detection 
algorithms to Space Shuttle Main Engine (SSME) test 
firing data. Both algorithms were applied to data 
collected during steady-state operation of the engine. 
One algorithm, the time scries algorithm, is based on 
time series techniques and involves the computation of 
autoregressive models. Tim; series techniques have been 
previously applied to SSME data. The second algorithm 
is based on standard sigmd processing techniques. It 
consists of tracking the vai iations in the average signal 
power with time. The average signal power algorithm is 
a newly proposed SSME failure detection algorithm. 
Seven nominal test firings were used to develop failure 
indication thresholds fer each algorithm. These 
thresholds were tested using four anomalous firings and 
one additional nominal firing. Both algorithms provided 
significantly earlier failure indication times than did the 
current redline limit system. Neither algorithm gave 
false failure indications lor the nominal firing. The 
strengths and weaknesses of the two algorithms are 
discussed and compared. The average signal power 
algorithm was found to have several advantages over the 
time series algorithm. 

Nomenclature 


AR 

autoregressive 

ARMA 

autoregressive noving average 

CADS 

command and data simulator 

e(i) 

unmeasurable d sturbance 

eiw) 

mathematical expectation of a random 
process x 

f 

frequency in heitz 

FPE 

final prediction error 

g(k) 

coefficients of the transfer function G(q) 

G(q) 

transfer function from u(t) to y(t) 

h(k) 

coefficients of the transfer function H(q) 

H (q) 

transfer function from e(t) to y(t) 

HPFP 

high pressure fuel pump 


HPFT 

high pressure fuel turbine 

HPFTP 

high pressure fuel turbopump 

HPOP 

high pressure oxidizer pump 

HPOT 

high pressure oxidizer turbine 

LPFP 

low pressure fuel pump 

LPOP 

low pressure oxidizer pump 

m 

lag index 

MCC 

main combustion chamber 

p(x) 

probability density function of random 
variable x 

P«(0 

power spectral density 

PBP 

prebumer boost pump 

PID 

parameter identification 

PSD 

power spectral density 

q-t 

shift operator 

fxJm] 

autocorrelation of a discrete stationary 
process at lag m 

RPL 

rated power level 

SSME 

space shuttle main engine 

T 

sampling interval in seconds 

u(t) 

input variable at time t 

x[n] 

discrete time function 

y(0 

output variable at time t 


Introduction 


An investigation was conducted to demonstrate the 
applicability of two steady-state failure detection 
algorithms to Space Shuttle Main Engine (SSME) data. 
One algorithm was based on time series techniques and 
the other on signal processing techniques. The 
algorithms were applied to improve the failure detection 
capability of safety systems during ground test firings 
and flight of the engine. With the current failure 
detection and control system on the SSME, several test 
firings have resulted in complete or partial loss of an 
engine. Forty-two firings have been classified as 
failures, and twenty-seven have had sufficient severity to 
be labeled as major failures. 1 The majority of these 
failures occurred during steady-state operation of the 
engine. Although this represents a small percentage of 



the more than 1300 hot fire tests to date, these failures 
resulted in significant engine and facility damage, loss 
of fleet leader engine components, and a delay in the 
program schedule. 

The current closed-loop SSME failure detection 
system employs basic redline limits. There are five 
redlined flight parameters; all monitor the high pressure 
turbopumps. These are the High Pressure Fuel Turbine 
(HPFT) and High Pressure Oxidizer Turbine (HPOT) 
discharge temperatures, the High Pressure Fuel Pump 
(HPFP) coolant liner pressure, the High Pressure 
Oxidizer Pump (HPOP) intermediate seal purge 
pressure, and the HPOT secondary seal cavity pressure. 
The redlined parameters have upper and/or lower limits 
assigned to them. Limit monitoring commences at 
scheduled times during startup and continues until the 
initiation of the shutdown phase. 2 The test firing 
failures described in Ref. 1 are evidence that a more 
advanced detection system is needed. The current limit 
monitoring techniques are not capable of detecting 
certain modes of failure with sufficient warning to avoid 
major hardware and facility damage. Significant 
improvements to safety would be realized by a system 
capable of detecting failures earlier than the current 
redline-based system. 

Several advanced failure detection algorithms have 
been proposed for the SSME. To date, they have been 
tested off-line on past failures and nominal test firings 
and have demonstrated the ability to detect failures prior 
to the existing redline-limit system. One such 
algorithm, which monitors individual parameters during 
steady-state operation of the SSME, is the System for 
Anomaly and Failure Detection (SAFD) algorithm. 3 
Another univariate approach which has been applied to 
steady-state SSME data is time series analysis. 4 Two 
multi-parameter algorithms have been proposed for 
improved steady-state failure detection. They are the 
Health Monitoring System for Rocket Engines 
(HMSRE) algorithm 5 and the clustering algorithm. 4 
Finally, an approach developed to detect failures during 
non-steady-state operation of the SSME is the 
Recursive Structure Identification (RESID) technique 4 

Two univariate failure detection algorithms were 
investigated and compared in this study. Both 
algorithms were employed during steady-state operation 
of the engine at 104 percent Rated Power Level (RPL) 
and 109 percent RPL. The algorithm based on time 


series techniques had been previously reported and 
consisted of using Autoregressive (AR) models to 
predict the future behavior of parameters based on their 
past behavior. The time series algorithm was restricted 
to stationary signals because it involved the 
computation of models for signal prediction. Each 
model was computed over a 4-sec window, and errors 
between predicted and actual values were tracked over 
subsequent 4-sec windows. The second algorithm 
investigated, the average signal power algorithm, was 
based on a well-developed signal processing technique 
which has proven to be beneficial in all types of 
mechanical signature analysis. 6 The algorithm consisted 
of computing and tracking the average power of a signal 
over a 2-sec moving window. A smaller window was 
possible for the average signal power algorithm because 
this algorithm did not have model validity concerns. 
The smaller window decreased the time until the 
algorithm was available for failure detection. 
Furthermore, a stationary assumption could be made 
over the 2-sec computation window, allowing the 
average signal power algorithm to be applied to five 
more parameters than the time series algorithm. This 
paper presents the theoretical foundation of the time 
series and average signal power algorithms, and 
discusses their application to the SSME failure 
detection problem. The failure indication times of the 
two algorithms are presented, along with a comparison 
of the strengths and weaknesses of the algorithms. 

The application of the time series algorithm and the 
average signal power algorithm was accomplished using 
a system identification and signal processing software 
package on a RISC workstation. Command and Data 
Simulator (CADS) data from seven nominal SSME 
tests were used to establish the failure indication 
thresholds for each algorithm. These tests were A2-457, 
A2463, A2-479, A2-480, A2-481, A2-483, and A2- 
484. Both algorithms were tested with CADS data from 
four failures, A2-249, Al-340, Al-364, and Al-436, 
and one recent nominal test firing, A 1-6 18. The first 
half of a test firing designation indicates the test stand 
on which the firing took place, and the second half 
indicates the test number. When the two algorithms 
were used in the failure detection mode, AR models 
were computed for 9 parameters, and the average signal 
power was computed for 14 parameters. The AR 
parameters were chosen because they typically displayed 
stationary behavior during steady-state operation of the 
engine. Furthermore, failure investigation summaries 
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indicated that some of the parameters chosen provided 
early failure indications for many of the anomalous test 
firings. 2 Parameters which were strongly affected by 
engine processes such as tank venting and pressurization 
could not be analyzed by either algorithm. The average 
signal power algorithm was applied to the one redlined 
parameter which was available in the four anomalous 
data sets and which met the above considerations. This 
parameter was the HPFT discharge temperature. 

Theo ry 


Time Series Techniques 

System identification is the process of selecting 
models created from experimental data that will 
represent the system or some of its properties. The 
approach generally followed is to model the system 
using measured input and output signals. In special 
cases where only single sign;ils are recorded, a model is 
generated which will produce similar output when 
excited by white noise. 

Generally, most applications of parametric 
estimation use discrete linear time series modeling 
techniques. This is due to Wold s fundamental theorem, 
which states that any stationary stochastic process can 
be expressed as the sum of two stationary and mutually 
uncorrelated processes. 6 For a general linear input- 
output configuration, a complete model description is 
given by 

y(t) = G(q)uO + H(q)e(t) (1) 


where 


G(q) = £g(k)q k H(q)= 1+ £h(k)q k 

k=l k=l 

( 2 ) 


and y(t) is the output signal, u(t) is the input signal, 
and e(t) is an unmeasurable disturbance into the 
system. 7 


The functions G and H are determined during 
modeling. To estimate these functions, G and H are 
parameterized as rational functions in the shift operator 
q-t. By parameterizing Eq. (1), the general parametric 
model structure is given by 


A(q)y(t) = 


B(q) 

F(q) 


u(t) + K7T e(t) 
D(q) 


( 3 ) 


where 


A(q) = l+a!q' l + +a na q~ na 

B(q) = t^q -1 + b 2 q 2 + +b nb q -nb 

C(q) = l+c 1 q -1 + +c IK q" nc 

D(q)=l+d 1 q~ l + +d nd q _nd 

F(q) = 1+f jq -l + +f„^‘ nf 

The orders of the polynomials are given by na, nb, nc, 
nd and nf. For the AR model nc = nd = nf = 0, and 
C(q) = D(q) = F(q) = 1. Another commonly used model 
is the Autoregressive Moving Average (ARMA) model 
in which nd = nf = 0 and D(q) = F(q) = 1 ? 

When there is no input into the system, u(t) = 0, 
the model given in Eq. 3 becomes 

A(q)y(t) = C(q)e(t) (4) 

Equation (4) represents the general ARMA model 
structure for the case when no input is present. For the 
AR model, C(q) = 1 in Eq. (4). These univariate models 
predict the behavior of a single parameter based upon 
the analysis of the past data of that parameter. C(q) is 
the moving average portion of the model, and attempts 
to describe the properties of the disturbance term, e(t). 7 

The decision of which model type and order to 
select is a trade-off between implementation issues and 
the accuracy with which the model is able to describe 
the parameter. For example, in a real-time hardware 
implementation AR represents less computational 
burden than ARMA. Furthermore, for a given model 
type, lower order models can be computed more quickly. 
Therefore, given several models with similar prediction 
capabilities, the least complex model should be chosen. 

The Final Prediction Error (FPE), a measure of the 
prediction capability of a model, simulates cross 
validation with another data set. The model with the 
smallest FPE should be chosen. The stability of the 
model is checked using a pole-zero diagram; all poles 
and zeros must lie within the unit circle. A near pole- 
zero cancellation indicates that a lower order model 
should be chosen. Also, if any of the uncertainty 
regions associated with the poles or zeros overlap, or 
cross the stability circle, a lower model order should be 
chosen. The frequency response comparison and the 
residual analysis are developed to determine the ability 
of the model to predict the data. The residuals between 
the actual data values and the modeled values should be 
random noise for the model to be a good predictor of the 
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system. This is checked by computing the autocorrela- 
tion function of the residuals. 7 

Signal Processing Techniques 

For discrete random processes, probabilistic 
functions are used to describe the behavior of the 
system. The mean or expected value of a random 
process at time n is given by Eq. (5): 

x[n] = £{x[n]} (5) 

where 

7 ( 6 ) 

£(x}= Jxp(x)dx 

and p(x) is the probability density function of x. 

The autocorrelation function, r xx [nl,n2], of a 
random process at two different times ni and n 2 is 
defined as 

r^[n 1 ,n 2 ] = £(x[n 1 ]x*[n 2 ]} CD 

where x* is the complex conjugate of x. For a 
stationary random process, the autocorrelation depends 
only on the time-difference or lag index, ni-n 2 or m. 
The autocorrelation of a stationary discrete random 
process is thus given by 

r^m] = 8{x[n + m]x*[n]} ® 

To describe how the variance of a random process is 
distributed with frequency, the Power Spectral Density 
(PSD) is computed. For stationary signals the PSD is 
given by Eq. (9), which is bandlimited to ±1/(2T), and 
is defined as the discrete-time Fourier transform of the 
autocorrelation function. 

- (9) 

P«(0 = T S r xxM exp(- j27cfmT) 

m=-« 

The inverse discrete-time Fourier transform of Eq. (9) 
yields an expression for the autocorrelation function 

r„[m] = J* P„(f ) exp(j27tfmT)df ° 0) 

*~lT 

If the autocorrelation function given in Eq. (10) is 
evaluated at zero lag, then an expression for the average 
signal power of a random stationary process results: 


Average Signal Power = r„[0] = P^f )df 

Jt 

( 11 ) 

Equation (11) indicates that the area under the PSD is 
the average power, and emphasizes that the PSD is a 
density function that represents the distribution of 
power with respect to frequency. 8 

A pplication 

In applying the algorithms, several system 
conditions required consideration in order to ensure that 
the algorithms would not erroneously indicate an engine 
fault These conditions were sensor failure, propellant 
tank venting and pressurization, and propellant transfer. 

Both nominal and anomalous test firings have 
experienced sensor failures. Sensor failure detection 
methods must be employed before, or concurrently, 
with safety monitoring algorithms in order to eliminate 
the possibility of a sensor failure being interpreted as an 
engine problem. For this investigation, all parameters 
exhibiting sensor problems were removed prior to the 
application of the two algorithms. 

Some test Firings have included propellant transfer 
from barges, or propellant tank venting and pres- 
surization. For several parameters, these processes 
introduce transient excursions that are not due to power 
level transitions. Figure 1(a) illustrates the effect of 
venting followed by pressurization on the HPOP inlet 
pressure for test firing A2-463. The decrease and 
subsequent increase observed in the signal correspond 
directly to the venting and pressurization processes. 
Figure 1(b) shows the Main Combustion Chamber 
(MCC) controller reference pressure for the same test. 
The controller reference pressure has been included so 
that the effects due to power level transitions can be 
differentiated from the effects due to tank venting and 
pressurization. In a test without venting or pres- 
surization, the curves in Figs. 1(a) and (b) would have 
similar shapes. 

Time Series Algorithm 

AR models were computed for the nine parameters 
indicated in Table 1. The Parameter Identification (PID) 
numbers listed in Table 1 are used to label the para- 
meters on SSME data tapes. The additional parameters 
given in Table 1 displayed excursions or non-stationary 
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behavior as compared to the model computation 
interval, and thus did not satisfy the stationary 
requirement of the time series algorithm. In many cases, 
this non-stationary behavior was due to tank venting, 
pressurization, or propellant transfer. In order to apply 
the time series algorithm to additional parameters, a 
method which would remove the transient effects caused 
by these processes is required. 

The AR and ARMA models were created during 
4 sec of engine operation in which the parameter 
exhibited steady-state or stationary behavior. Not all 
parameters achieved steady-state behavior at the same 
time following the scheduled completion of a transient. 
Therefore, a safety factor cf at least 2 sec was allowed 
prior to model construction This allowed models for all 
parameters of a given test firing to be computed over 
the same interval. For ^ase of computation and 
interpretation, the mean v/as removed from the data 
prior to model construction. The 4-sec window 
represented a trade-off between model computation time 
and model prediction accuracy. A larger computation 
window increased the ability of the model to accurately 
predict future signal behavior, however, a larger window 
also increased the time during which the time series 
algorithm was not available for safety monitoring. 

Each model was evaluated using four criteria. These 
criteria were (1) monitoring the FPE, (2) computing the 
poles and zeros of the model and checking for stability 
and overlap, (3) comparing the actual frequency response 
to that of the model, and (4) ensuring that the residual 
autocorrelation function did not exceed the confidence 
interval. In applying these criteria to AR and ARMA 
models of various orders, it was found that the 
autoregressive model of order five, AR[5], provided the 
most consistent, adequate representation of the data. 
This concurred with the pre viously reported AR model 
order applied to SSME dafcL 4 In general, it was found 
that ARMA models introduced spurious information 
into the model frequency response. Also, ARMA 
models experienced stability problems, and had added 
computational burden. AR models of an order less than 
five successfully described only a minority of the 
parameters. As the AR model order was increased to 
values greater than five, rmtrginal improvements in the 
FPE and the residual autocorrelation function were 
sometimes observed, but th^ frequency response of the 
model and data began to diverge. 

Once a model had be^n created, it was used to 
predict the future behavior of the signal. The 4-sec 
window was moved forward in time in 1-sec increments; 
thus, any two adjacent windows overlapped by 


75 percent. For each window the autocorrelation 
function of the residuals was computed for lags between 
0 and 25. One lag was equivalent to one sampling 
interval or 40 msec. When implemented in hardware, 
the 1-sec time increment could be decreased to the 
40 msec sampling rate to improve the failure detection 
capability of the algorithm. 

Due to the highly dynamic nature of the system, 
the residual confidence interval was often exceeded for 
the A2 nominal tests. This necessitated thresholds to be 
established to prevent incorrect failure indications. The 
thresholds given in Table 2 represent the maximum 
absolute value of the residual autocorrelation function 
for all of the A2 nominal tests at either 104 percent 
RPL or 109 percent RPL. Although the models 
generated at 104 percent RPL were often adequate in 
describing the data at 109 percent RPL, both models 
were computed in order to base the thresholds on a 
larger data set. If the residual autocorrelation function 
for the model computation window fell outside the 
confidence interval, the model was not included in the 
threshold determination. When used in the failure 
detection mode, failure of an autocorrelation function to 
fall within the threshold interval given in Table 2 
resulted in a failure indication. 

In applying the time series algorithm to parameters 
that were susceptible to venting and pressurization, 
extremely high thresholds were required to ensure no 
false failure indications. This was expected since these 
parameters exhibited non-stationary behavior. For 
example, the Low Pressure Oxidizer Pump (LPOP) 
shaft speed (PID 30) required a threshold of 0.9 on a 
scale of one. A threshold of this magnitude clearly 
indicates that the time series algorithm is not an 
appropriate failure indicator. 

Average Signal Power Algorithm 

The average signal power of various SSME 
parameters was determined by computing the 
autocorrelation at zero lag, as given by Eq. (11), for the 
parameters listed in Table 1. This equation assumes that 
the signal is stationary over the compulation interval. 
Although some parameters exhibited overall non- 
stationary trends, stationary behavior was achieved 
during the 2-sec compulation interval. Therefore, the 
computation of the average signal power using the 
autocorrelation function was valid. 

The average signal power calculations were 
performed over 2-sec, 50 percent overlapping windows 
for the A2 nominal test Firings at both 104 percent RPL 
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and 109 percent RPL. In order to base the threshold 
calculations on a larger data set, both engine power 
levels were used in the determination of the failure 
indication thresholds. This was possible since the 
average signal power was not consistently higher at 
either power level. The 2-sec window and 1-sec time 
increment were selected for ease of computation. In a 
hardware implementation, the window could be 
decreased to minimize the initial computation time 
during which the algorithm would not be available for 
failure detection. Also, the time increment could be 
decreased to improve the failure detection capability of 
the algorithm. As in the time series algorithm, the 
mean was removed from the data prior to the application 
of the algorithm. 

The average and three standard deviations of the 
average signal power were computed for all seven A2 
nominal firings at both engine power levels. To 
calculate the thresholds, these values were combined as 
shown in Eq. (12). The expectation operator, £ , used in 
Eq. (12) was previously defined in Eq. (6). 

threshold = [— — * 2,8(average power 4 ) + 

2 7 i=i 

. 2*7 

— — * V 3 * standard deviation.] * safety factor 
2*7 

( 12 ) 

A factor of safety from 1.5 to 3.5 was needed to ensure 
no false failure indications for the A2 nominal firings. 
The safety factors reflected the variations in signal 
behavior observed over these firings. The thresholds and 
safety factors are given in Table 2. When used in the 
failure detection mode, failure of the average signal 
power of a parameter to fall beneath its threshold results 
in a failure indication. 

For some of the parameters sensitive to venting and 
pressurization, the required safety factors were greater 
than 2.5. These parameters were the HPOT discharge 
temperatures (PIDs 233 and 234) and the Prebumer 
Boost Pump (PBP) discharge temperature (P1D 94). The 
high safety factors were attributed to the transient 
behavior introduced by the venting and pressurization 
processes. As with the time series algorithm, the 
average signal power algorithm could be applied to a 
larger set of parameters if the effects due to these 
processes could be removed. In addition, the HPFP shaft 
speed (PID 260) also required a large safety factor. This 
was attributed to the extremely noisy signal observed 
for this parameter. The larger safety factors decreased the 


ability of the average signal power algorithm to detect 
engine anomalies, thereby degrading the effectiveness of 
the algorithm. Thus, the parameters which required 
factors of safety greater than 2.5 were not used for 
failure detection. 

Results and Discussion 

Failure indication thresholds were established by 
applying the time series and average signal power 
algorithms to seven A2 nominal tests. Four anomalous 
firings and one A1 nominal firing were tested using the 
thresholds given in Table 2. 

The four anomalous test firings analyzed, A2-249, 
Al-340, Al-364, and Al-436, were all High Pressure 
Fuel Turbopump (HPFTP) failures. Detailed failure 
summaries may be found in Ref. 2. These firings were 
chosen for two reasons: (1) the failures occurred during 
steady-state operation of the engine and (2) the firings 
exhibited failure indications before redline cutoff values 
were attained. In addition, a more recent nominal firing, 
A 1-61 8, was also tested against the thresholds to ensure 
that false failure indications would not occur. Although 
only HPFTP anomalies were considered, performance 
parameters from many parts of the engine were selected. 
The high degree of interdependence among engine 
components typically causes a failure in one component 
to quickly manifest itself throughout the engine. 

In applying the time series algorithm to the 
parameters indicated in Table 1, a series of plots was 
developed to evaluate the validity of the computed 
models. Figure 2 displays an example of the plots 
necessary in determining validity of the AR[5] model 
for the HPFP discharge pressure for test A2-463. 
Figure 2(a) displays the five zeros of the model, along 
with the uncertainties in their locations. The 
uncertainties are calculated for both the real and 
imaginary parts; thus, the uncertainty in location of the 
real zero is given by a line. As required for stability, the 
zeros all lie within the unit circle, and their uncertainty 
regions do not overlap or cross the unit circle. 
Figure 2(b) compares the trends in the frequency 
response of the model with the trends in the frequency 
response of the actual data. As can be seen, these two 
curves respond similarly with frequency. Finally, the 
autocorrelation function of the residuals for the 4-sec 
model computation window is given in Fig. 2(c). The 
autocorrelation of the residuals is well within the 
confidence interval for lags greater than zero, indicating 
that the residuals are random noise as required. These 
figures demonstrate that the AR[S] model is a valid 
predictor of the HPFP discharge pressure. 
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Figure 3 is an example of the application of the 
time series algorithm to an anomalous test Firing, The 
HPFP discharge pressure for test Al-340 is the 
parameter shown. Within each 4-sec window, the 
autocorrelation function of the residuals is computed, 
and the maximum value exceeding the confidence 
interval is plotted as a function of time. The failure 
indication thresholds for the HPFP discharge pressure 
are also indicated in Fig. 3. rhe parameter exceeds the 
thresholds seven times. These times correspond to the 
events detailed in the failuie summary report for this 
test firing. During test A1-M0, the Turn/ Around duct 
inner wall fractured at 20.6 sec and major ruptures 
occurred at 290 sec. 2 Figure 3 also displays the tendency 
of the residuals to exceed \hz thresholds for an interval 
of time, and then subsequently fall back between the 
thresholds. This can be attributed to attempts, by the 
engine, to compensate for anomalous occurrences and 
return to a nominal mode of operation. 

Table 3(a) lists a majority of the failure indication 
times obtained by applying the time series algorithm to 
the four anomalous test firings. The values listed 
indicate the times, in secords from start, at which a 
given parameter exceeded its failure indication 
thresholds. In some cases, the residual autocorrelation 
function confidence interval was exceeded for the model 
computation window. Such models became biased 
estimators of future behavior and were therefore 
considered invalid. The parameters affected by this 
phenomenon were the mixture ratio (PID 8) for test 
firings Al-340 and Al-364, and the Low Pressure Fuel 
Pump (LPFP) shaft speed (PID 32) for test firing Al- 
364. The question of model validity presents a unique 
implementation concern for the time series algorithm. 
A model can be checked in real-time; however, it cannot 
be recomputed using a different order number. Thus, the 
failure detection capability of the time series algorithm 
would be compromised as ihe number of parameters 
with invalid models increased. 

When space permitted, all of the times at which the 
time series algorithm thresaolds were exceeded are 
included in Table 3(a). For some parameters, the times 
that the thresholds were exceeded were too numerous to 
list completely. For these p<irameters, the first failure 
indication times are given, as well as those times which 
were in closest agreement v/ith the failure indication 
times of the other parameters. This was done to show 
agreement among the parameters of a given test firing 
and to provide insight into the progression of engine 
problems during the test firiag. For example, test A2- 
249 showed agreement among several parameters at 
approximately 398 sec. This could be in response to the 


melting of the Kel-F ring documented at 374 sec. 2 
However, the MCC pressure (PID 130), the HPFP shaft 
speed (PID 260) and the LPFP shaft speed (PID 32) 
clearly gave earlier indications of abnormal engine 
behavior at 123, 156, and 146 sec, respectively. The 
failure summary report indicated that cavitation of the 
HPFP commenced at 108 sec due to the increased pump 
inlet temperatures caused by propellant transfer. 

For each anomalous firing, two types of failure 
indication times for the time series algorithm were 
extracted from Table 3(a). The first type was the first 
time at which any parameter of a given test firing 
exceeded its failure indication thresholds. The first 
failure indication times for tests A2-249, Al-340, Al- 
364, and Al-436 were 123, 21 , 137 and 176 sec, 
respectively. These times were at least 250 sec earlier 
than the corresponding redline cutoff times which are 
also given in Table 3(a). The second type of failure 
indication time is the first time at which two or more 
parameters simultaneously indicated a failure. Table 3(b) 
lists these times for the four anomalous firings, along 
with the number of parameters in agreement. The first 
simultaneous failure indication times occurred at least 
50 sec prior to the redline cutoff times. The first 
simultaneous failure indication times are significant 
since agreement between two or more parameters 
increases the likelihood that an engine problem has 
occurred. In the absence of a thorough sensor signal 
validation package, agreement among several sensors 
minimizes the chance of a sensor failure being 
interpreted as an engine problem. On the other hand, 
requiring multiple parameters to exceed the thresholds 
simultaneously reduces the ability of the algorithm to 
detect failures before they have propagated through the 
system. For the anomalous firings studied, either of the 
time series algorithm failure indication times could have 
alerted engine operators and prevented the progression of 
these failures to catastrophic levels. 

An example of the computation of the average 
signal power for a nominal test firing is given in 
Fig. 4. The interval over which the average signal 
power was computed for the HPFP discharge pressure 
for test firing A2-457 is given in Fig. 4(a), and the 
resulting average signal power is given as a function of 
time in Fig. 4(b). The fluctuations in the average signal 
power were observed in all of the nominal firings and 
were considered normal. The fluctuations were taken 
into account in calculating the thresholds for the 
parameters. The HPFP discharge pressure had a 
threshold of 436, well above the maximum average 
signal power shown in Fig. 4(b). 
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An example of the application of the average signal 
power algorithm to an anomalous test firing is given in 
Fig. 5. Figure 5(a) shows the interval over which the 
average signal power was computed for the HPFP 
discharge pressure for test firing A 1-340. Figure 5(b) 
displays the resulting average signal power, as a 
function of time. The failure indication threshold 
calculated from the A2 nominal firings is also shown. 
As can be seen, increases in the average signal power 
concur with the deviations observed in the signal. The 
maximum average signal power for test A 1-340 is 
almost an order of magnitude greater than the maximum 
average signal power for a nominal firing. Figures 3 and 
5(b) show that, for the HPFP discharge pressure, the 
thresholds for both algorithms were exceeded at 
approximately the same times. However, the average 
signal power exceeded its threshold by a much larger 
percentage than did the time series algorithm. This may 
be critical if testing against additional nominal firings 
required the thresholds to be increased. 

Table 4(a) summarizes the application of the 
average signal power algorithm to the four anomalous 
test firings. The values listed indicate the times, in 
seconds from start, at which a given parameter exceeded 
its average signal power threshold. Most of the times at 
which the thresholds were exceeded were included in 
Table 4(a) to show agreement among parameters of a 
given test firing and to demonstrate the progression of 
the failure during the test firing. For example, test 
firing Al-340 showed agreement among five parameters 
at 21 sec and eight parameters at 290 sec. As stated 
previously, this concurred with the failure investigation 
summary report which states that the Turn/ Around duct 
inner wall fractured at 20.6 sec and major ruptures 
occurred at 290 sec. 2 

The two types of failure indication times deter- 
mined for the time series algorithm were also considered 
for the average signal power algorithm. The first failure 
indications for the average signal power algorithm for 
tests A2-249, Al-340, Al-364, and AM36 were 61, 
21, 149, and 32 sec, respectively. These times were at 
least 240 sec earlier than the corresponding redline 
cutoff times which are given in Table 4(a). The first 
time at which two or more parameters exceeded their 
thresholds are given for each anomalous test firing in 
Table 4(b), along with the number of parameters which 
were in agreement. Generally, the first simultaneous 
failure indication times were substantially earlier than 
the redline cutoff times. As with the time series algor- 
ithm, the simultaneous indication of a fault by two or 
more parameters increases the likelihood that an actual 


engine problem has occurred and minimizes the chance 
of erroneous failure indications. 

A comparison between Tables 3(a) and 4(a) 
indicates that the average signal power algorithm 
detected an engine problem 62 sec earlier than the time 
series algorithm for firing A2-249 and 144 sec earlier 
for firing Al-436. For test Al-340, the two approaches 
had identical first failure indication times, and for test 
Al-364, the time series algorithm indicated a failure 
condition 12 sec earlier than the average signal power 
algorithm. The HPFP shaft speed (PID 260) provided 
the earliest failure indication time for test Al-364. This 
parameter was not evaluated by the average signal power 
method due to the high safety factor required. For all 
four anomalous firings, the HPFP shaft speed provided 
early failure indications using the time series algorithm. 
This was expected since the four anomalous firings 
considered in this study were all HP FTP failures. The 
average signal power was computed for six parameters 
to which the time series algorithm was not applied. 
With the exception of the LPOP shaft speed (PID 30), 
these additional parameters provided failure indications 
earlier than the redline cutoff times. For test A2-249, 
one of the additional parameters, the HPFT discharge 
temperature (PID 231), gave the earliest failure 
indication time. 

By comparing Tables 3(b) and 4(b), it is evident 
that the average signal power algorithm had a greater 
number of parameters contributing to the first simul- 
taneous failure indication time for each anomalous test 
firing. A larger number of concurring parameters 
increased confidence in the ability of the average signal 
power algorithm to detect actual engine failures. The 
two algorithms had an identical first simultaneous fail- 
ure indication time for test A2-249. For tests Al-340 
and Al-436, the average signal power algorithm gave 
times that were 270 and 321 sec earlier than the time 
series algorithm, respectively. For Al-364, the time 
series algorithm gave a time which was 233 sec earlier. 
Simultaneous failure indication times were explored to 
demonstrate the need for shutdown recommendation 
criteria in addition to failure indication thresholds. 
Failed sensors are of particular concern since no 
thorough sensor screening techniques currently exist on 
the SSME. It is vital that an algorithm not issue a 
shutdown command because of a failed sensor. The 
shutdown recommendation criteria must be established 
to ensure no erroneous failure indications on a nominal 
test, even in the event of failed sensors. 
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An additional nominal firing, Al-618, was tested 
using the time series and average signal power 
thresholds developed in this study. This was done to 
increase confidence in ihe thresholds of the two 
algorithms. Neither algoiithm produced any failure 
indications for this test firing. An extensive amount of 
testing against additional nominal test firings is required 
to validate and refine the proposed thresholds, and to 
establish shutdown recommendation criteria based on 
the thresholds. Testing against additional anomalous 
firings would further defire the capabilities of the two 
algorithms. 

Concludi n g Remark s 

The earliest possible detection of anomalous 
behavior during a firing of the SSME is critical. This 
investigation determined the ability of two algorithms 
to detect the onset of engine faults during steady-state 
operation of the engine. Tine series techniques had been 
previously studied. In this investigation, the time series 
algorithm used fifth order AR models to predict the 
future behavior of parameters based on their past 
behavior. The average signal power algorithm was a 
newly proposed SSME failure detection algorithm. It 
consisted of computing ar d tracking variations in the 
average signal power with time. The same seven A2 
nominal tests were used to develop parameter fault 
indication thresholds for both algorithms. These 
thresholds were applied to four anomalous firings and 
one additional nominal firing. 

For all four anomalous test firings, both the time 
series algorithm and the average signal power algorithm 
provided first failure indication times and first 
simultaneous failure indication times that were 
significantly earlier than the redline cutoff times. For all 
four firings, the average signal power algorithm had a 
larger number of parameters contributing to the first 
simultaneous failure indication times. This is 
significant since agreement between several parameters 
increases the likelihood that an engine problem has 
occurred, and minimizes the chance of false failure 
indications. Confidence in both algorithms was further 
established when the thresholds did not produce any 
erroneous failure indications for the additional nominal 
firing. 

The average signal power algorithm had several 
advantages over the time series algorithm. A longer 
window was needed for the time series algorithm to 
ensure model validity. The longer window increased the 
time during which this algorithm was not available for 
failure detection. Even with this longer window several 


of the calculated models were invalid. The question of 
model validity presented a unique implementation 
concern for the time series algorithm. A model can be 
checked in real-time; however, it cannot be recomputed 
using a different order number. A large number of 
invalid models on a test firing would compromise the 
failure detection capability of the time series algorithm. 
The average signal power algorithm was applicable to a 
larger set of performance parameters because it did not 
depend as rigidly on the stationary behavior of the 
signal. Stationary behavior was achieved over the 2-sec 
interval used to compute the average signal power, 
allowing this algorithm to be applied to parameters 
exhibiting overall non-stationary trends. 

Some types of sensor failures would cause both of 
the algorithms to exceed their thresholds. This indicates 
the need for sensor failure detection methods in order to 
eliminate the possibility of a sensor failure being 
interpreted as an engine problem. Both algorithms were 
affected by engine processes such as tank venting and 
pressurization, although the average signal power 
algorithm was less sensitive because it did not involve 
the computation of a model. Both algorithms could be 
applied to a larger set of performance parameters if a 
technique were developed to remove the transient effects 
caused by these processes. 

The failure indication thresholds developed in this 
investigation must be tested extensively against 
additional nominal and anomalous firings. The nominal 
tests would refine the thresholds to ensure no erroneous 
failure indications, and the anomalous test firings would 
further demonstrate the capabilities and limitations of 
the algorithms. Finally, shutdown recommendation 
criteria must be developed for the algorithms. 
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Parameter Name 

Time Series 

Ave. Power 

8 

Mixture Ratio 

X 

X 

17 

MCC Coolant Discharge Press. 

X 

X 

24 

MCC Hotgas Injector Press. 

X 

X 

ao 

LPOP Shaft Speed 


X 

32 

LPFP Shaft Speed 

X 

X 

52 

HPFP Discharge Pressure 

X 

X 

58 

Fuel Preburner Chamber Press. 

X 

X 

59 

PBP Discharge Pressure 


X 

90 

HPOP Discharge Pressure 

X 

X 

94 

PBP Discharge Temperature 


X 

130 

MCC Pressure 

X 

X 

203 

HPFP Inlet Pressure 


X 

209 

HPOP Inlet Pressure 


X 

231 

HPFT Disharge Temp. A 


X 


HPFT Disharge Temp. B 


X 

233 

HPOT Discharge Temp. A 


X 

234 

HPOT Discharge Temp. B 


X 

260 

HPFP Shaft Speed 

X 

X 


x - algorithm applied 

Table 1. Description of PID numbers used with time series and average signal power 
algorithms. 
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I 'ID No. 

Time Series 
Thresholds 

Average Power | 

Thresh- 

olds 

Safety 

Factors 

8 

+ .60 

.00112 

1.5 

17 

±.50 

200 

1.5 

24 

±.50 

125 

1.5 

30 

-- 

1598 I 

2.5 

32 

±.55 

2509 

1.5 

52 

±.50 

436 

1.5 

58 

±.60 

232 

1.5 

50 

-- 

911 

1.5 

90 

±.475 

268 

1.5 

94 

-- 

.04 

3.0 

130 

±.50 

47 

1.5 

203 

-- 

4 

1.5 

209 

-- 

6 

1.5 

231 

-- 

32 

2.0 

232 

-- 

38 

2.5 

233 

-- 

154 

3.5 

234 

-- 

104 

3.5 

260 

±.65 

550000 

3.5 


Table 2. Thresholds calculated from the nominal test 
firings for the time series algorithm and the 
average signal power algorithm, and safety 
factors for the average signal power algorithm. 
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A2-249 


Al-340 


Al-364 


A 1-436 


pro No. 





8 1 

a 

c 

c 

a 

17 

398-401 

291-293 

154,245 

387-90 

176,242 

24 

a 

290 

388-90 

a 

32 

146-8,... 224- 
35,. ..304-5,... 
390-7,402-10,.. 
421-49 d 

280,291-93 

c 

369-70,377-9 

394-6,414 

432-33 

52 

398-399 

21-3,291-3 

380 

389-390 

a 

58 

b 

b 

387-90 

a 

90 

401 

b 

203,245,302 

387-390 

a 

130 

123,306-307 

399 

291-93 

387-90 | 

a 

260 

156-227 

229-32,430-1 

434 

56-65,... 
99-247,... 
276-9 d 

137,142-56,... 

300-75,377, 

390-l d 

203,205,... 
353-423,425- 
511, ...588-9 d 

Redline 
Cutoff Time 

450.58 

405.5 

392.15 

611.06 


a threshold not exceeded 
b failed sensor 
c model not valid 

d times too numerous to list completely 

Table 3a. The times, in seconds from start, at which the four anomalous test 
firings exceeded the time series algorithm failure indication 
thresholds. 



A2-249 

Al-340 

Al-364 

Al-436 

First 

Simultaneous 

Failure 

Indication Time 

398 

291 

154 

369 

Number of 

Concurring 

Parameters 

2 

4 

2 

2 


Table 3b. The first times, in seconds from start, at which two or more 
parameters simultaneously indicated failure, and the number of 
parameters which exceeded their thresholds at these times. 
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TestNo. 

proN<K'\^ 

A2-249 

Al-340 

1 

Al-364 

Al-436 

8 

a 

22,290-291 

a 

a 

17 

399,413 

21-2,290-1 

357-358 

387-388 

a 

24 

a 

21-2,290-2, 

358 

a 

32-3, ..47-8,.. 
72-8,83-4,90-1 
..117-9, ..201-2 
221-3, ..231,.. 

3 19-20, ..467-8 c 

30 

a 

b 

a 

a 

32 

a 

290-291 

a 

a 

52 

398-399,413 

21-2,290-1 

357-358 

387-388 

a 

58 

b 

b 

387-388 

a 

59 

106,399 

21,290-291 

387 

48-9,72-3,90-1 
119,202,221-3, 
..,319,343-4,.. 
484, ..543,.. 
580 c 

90 

a 

b 

a 

49 

130 

398-399 

21-2,290-1 

357-358 

387-388 

48-9,72-3,91 

150,201-2,241 

344,461,475 

484485 

203 

a 

290-291 

a 

a 

209 

38-89,125-126 

a 

211 

a 

231 

61,123, ..,398- 
400,410,413,.. 
431-4,443-6 
449 c 

b 

149,154,159 

182-3,219,244 

316-7,335, 

387-388 

205,319 

232 

137,327,409 

412-3,415-6 

429,433-6,447 

a 

387-388 

84,91,176,201 

231,297,373 

402-4,484,512 

543,603-4 

Redline 
Cutoff Time 

450.58 

405.5 

392.15 

611.06 


a threshold not exceeded 
k failed sensor 

c times too numerous to list completely 

Table 4a. The t mes, in seconds from start, at which the four anomalous test 
firings exceeded the average signal power algorithm failure 
indication thresholds. 
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A2-249 

Al-340 

Al-364 

Al-436 

First 

Simultaneous 

Failure 

Indication Time 

396 

21 

387 

48 

Number of 

Concurring 

Parameters 

3 

5 

7 

3 


Table 4b. The first times, in seconds from start, at which two or more 
parameters simultaneously indicated failure, and the number of 
parameters which exceeded their thresholds at these times. 




<b) MCC CONTROLLER REFERENCE PRESSURE FOR THAT TEST. 
(CONTROLLER REFERENCE PRESSURE SHOWS SCHEDULED POWER 
LEVEL TRANSITIONS.) 


FIGURE 1. - EFFECT OF TANK VENTIN6 FOLLOWED BY PRESSUR- 
IZATION. 
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(C) AUTOCORRELATION FUNCTION OF THE RESIDUALS FOR THE 
MODEL COMPUTATION WINDOW. 

T I SURE 2. - PLOTS USED TO DETERMINE THE VALIDITY OF THE 
ARI5I MODEL FOR THE HPFP DISCHARGE PRESSURE FOR TEST 
A2-463. 
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TIME, SEC 


FIGURE 3. - APPLICATION OF THE TIME SERIES ALGORITHM THRESHOLDS TO THE HPFP DISCHARGE 
PRESSURE FOR TEST A1-340. 



(a) INTERVAL OVER WHICH THE AVERAGE SIGNAL POWER WAS 
COMPUTED. 



TIME, SEC 


<b) AVERAGE SIGNAL POWER FOR THAT INTERVAL. 

FIGURE M. - COMPUTATION OF THE AVERAGE SIGNAL FOR THE 
HPFP DISCHARGE PRESSURE FOR NOMINAL TEST A2-457. 



(a) INTERVAL OVER WHICH THE AVERA6E SIGNAL POWER WAS 
COMPUTED. 



0 50 100 150 200 250 300 350 400 450 


TIME, sec 

(b) AVERAGE SIGNAL POWER FOR THAT INTERVAL WITH THE FAIL- 
URE INDICATION THRESHOLD. 

FIGURE 5. - APPLICATION OF THE AVERAGE SIGNAL POWER ALGO- 
RITHM TO THE HPFP DISCHARGE PRESSURE FOR TEST A1-340. 
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